Payload Decoded and Decrypted via Built-in Utilities

Tim Rauch (rule), Elastic (idea)

Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.

2022-10-17 00:00:00

None

234dc5df-40b5-49d1-bf53-0d44ce778eca

attack.t1059 attack.t1204 attack.execution attack.t1140 attack.defense-evasion attack.s0482 attack.s0402

Community Rule

Nasreddine Bencherchali

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12

frack113

Merge PR #4479 From @frack113 - Upgrade Rules Status

2023-10-17

Gude5

new rules: Sigma rules based on Elastic rules (#3632)

2022-10-28